But this does work:
authz-regexp
uid=([^,]*),cn=example.com,cn=gssapi,cn=auth
ldap:///dc=example,dc=com??sub?
(&(|(entryDN:dnSubtreeMatch:=ou=eng,dc=example,dc=com)
(entryDN:dnSubtreeMatch:=ou=bio,dc=example,dc=com))
(uid=$1)(objectclass=person))
I found what I needed to know on the man page for slapcat; first example.
Cheers,
Jaap